A 4.7 Product Rating Doesn’t Move AI the Way You’d Expect

19 min read

TL;DR

• An AI agent treats your review section as two separate things: an aggregate it does arithmetic on (star rating, review count) and a block of text it reads as language. Almost all review advice addresses only the first.
• In randomised trials on a controlled storefront, where a product sat on the page moved selection more than its review signals did. A top row slot carried a coefficient of +1.22 for one model. An “Overall Pick” badge carried up to +1.90.
• Instructions planted inside review text hijacked deployable shopping agents in 41.67% to 68.16% of runs across 3,168 adversarial trials. One template that simply skewed the agent’s product assessment worked 100% of the time on two of four systems.
• A star rating that contradicts a suspicious review is a real, measurable defence on some models and no defence at all on others.
• There is still no good study of how agents read ordinary review text when nobody is attacking them. I ran a small one. Two of three frontier models downgraded a product by quoting Amazon’s AI-generated review summary rather than any actual reviewer, and the sentiment they cited appears in none of the reviews they were shown.

If you run reviews for a living, you have spent years and real money getting your rating up. So has everyone you compete against.

The three tablets I tested last week were priced at $549, $859, and whatever the third one costs, because its listing did not say. All three were rated 4.7 out of 5.

When the ratings tie, the rating stops deciding anything. Something else picks the winner. And if the shopper is an AI agent rather than a person, nobody has really told you what that something is. Which is an irritating place to be standing after three years of funding a review programme.

So I ran the test myself. In July 2026 I took three live Amazon tablet listings and put the same brief to GPT-5 in ChatGPT, Claude Sonnet 5 and Gemini 3.6 Thinking: best overall value for daily use, media, light productivity, occasional note-taking. First with the listing data only, meaning title, specs, price, star rating and review count. Then again with the customer reviews pasted in underneath. One run per model per condition, six answers in total.

Two of the three came back marking the iPad down for mixed sentiment on battery life.

I went to check which reviewer had said that. None of them had. Five people in the text I handed over mention the battery. Ortal: excellent, lasts all day. StemCell: excellent. Jonathan Ham: amazing. Two more the same. Not one complaint among them.

The complaint was on the page, though. It sat in the grey box near the top headed “Customers say”, which looks like a summary of the reviews underneath and is nothing of the sort. Amazon writes that box with its own AI, drawing on thousands of reviews the models never saw. Both models had reached past the reviews to quote a machine, then called it customer sentiment.

Three models, one run each. That proves nothing on its own, and I will come back to exactly how little it proves. But it sent me looking for the published research on what these things do with a review section, and that research turns out to be excellent, very recent, and almost entirely about something else.

The fake shop

To find out what an AI agent buys, you have to build it somewhere to shop.

A team from Columbia Business School, Yale and a startup called MyCustomAI did exactly that. A storefront that looked like any other, eight products to a page in two rows of four, with every variable under their control: where each product sat, what it cost, its star rating, its review count, whether it wore a Sponsored tag or an Overall Pick badge. Then they pointed six frontier models at it and sent them shopping. A thousand runs per category, across eight deliberately dull categories: fitness watches, phone cases, mousepads, office lamps, staplers, toilet paper, toothpaste, washing machines.

The staplers are where it turns. Amazon Basics won, and won, and won. A brand called Arrow was never selected. Not seldom. Never.

Something was deciding these purchases, and it was not the product. The study is called ACES, it was revised in December 2025, and it is now published at the ACM Web Conference 2026. It is the best causal work anyone has done on this, and I will spend the next thousand words telling you what it found and then one paragraph on the thing it never tested.

Placement outranks prose

Move a product from the bottom of the grid to the top row and one agent became roughly five times more likely to buy it. Same product. Same price. Same reviews. It just moved.

Slap an “Overall Pick” badge on it and a Gemini-powered agent became more enthusiastic still. Slap a “Sponsored” tag on it and every model tested liked it less, which is either reassuring or an expensive discovery, depending on what you spend on retail media.

If you have spent real budget on a review programme, that ordering is a genuinely irritating thing to look at. A shelf position you may not control is doing more work than content you paid for.

The obvious response is to tell the agent to stop it. The researchers tried. They put an explicit instruction in the prompt to ignore position, and the bias barely moved. Then they stripped out the visuals entirely and fed the agent a plain ranked list of product data, no images, no page, on the theory that this was an artefact of reading screenshots. The bias survived that too.

One thing about the fake shop matters more than anything else in the paper, and the authors say so themselves. It had no product pages. Everything an agent needed sat on the results grid. Which means that across a thousand runs a category, eight categories, six models, those agents saw a star rating and a review count and never read a single review.

When a review stops being evidence and starts being an instruction

Here is the structural problem underneath all of this. A language model receives your instructions and the webpage content in the same stream of text. It has no reliable way to tell which is which. So a sentence written by a stranger in a review box arrives looking a lot like a sentence written by the user.

Somebody built a shop to test that too, and this one had a working checkout.

The rules were strict: the attacker could only touch what a real person can touch. Review text, ratings, seller metadata. No system prompts, no page structure, nothing behind the counter. Then 3,168 runs against two shopping agents you can download today, each paired with a frontier model. The work is called StakeBench, published in June 2026 by researchers at Nanyang Technological University, ST Engineering, IBM Research and the University of Illinois Urbana-Champaign.

The attack that should worry marketers is not the dramatic one. It is the dull one, filed in the paper as T1.2, which does nothing more exciting than nudge the agent’s opinion of a product. It worked on 100% of runs against both GPT-5 setups. It worked 94.4% of the time on one of the Gemini pairings.

It works because it does not look like an attack. When the injected instruction sits close to what the shopper already asked for, it sails through: steering someone towards a rival product in the same category succeeded roughly 71% to 79% of the time. Ask the agent to do something unrelated and success collapsed to between 5.6% and 27.8%, while the agent started behaving oddly enough that a human would probably notice.

The authors call the quiet version stealthy parasitism. The shopper gets a perfectly sensible recommendation and suspects nothing. The competitor loses a sale and never learns why. It is the same shape of failure as agents confirming orders that were never placed, invisible precisely because the output looks normal.

The one finding you can actually act on

Then they tried something simple. They left the malicious review exactly as it was and changed only the star rating attached to it, so the number disagreed with the words.

On GPT-5, attack success fell from 55.6% to 19.4%. The agent noticed the mismatch on its own and trusted the review less.

On Gemini 2.5 Flash, the numbers were 83.3% and 86.1%. It did not care at all.

So consistency across your review data is a real defence that you cannot rely on, because whether it protects you depends on a model choice made by someone who has never heard of your company. And there is a channel almost nobody is watching: in a small side experiment the same team changed only a product image, leaving text, ratings and page structure untouched, and moved one item from 10% of agent selections to 76.7%.

The Machine-Read Audit

Five checks. Each one comes from a specific finding above rather than from anyone’s opinion, and you can run the whole thing on one product page in an afternoon.

Step five is the one everyone skips, so here is what it protects against. In August 2025 a Fitbit Inspire was the modal choice of a Claude-powered agent 45% of the time. Anthropic shipped a new model. By December the same tablet on the same page was winning 77% of the time. Meanwhile OpenAI shipped too, and the same Fitbit fell from 25% to 6%.

Nobody changed the price. Nobody wrote a review. Two companies in California shipped software and a product’s share of an entire buying channel roughly doubled in one case and collapsed by three quarters in the other. In phone cases it was starker: GPT-4.1 picked a brand called Mikeke 62.6% of the time, and GPT-5.1 picked it 5% of the time.

That is a demand shock arriving in a release note, which is the practical argument for treating how AI systems perceive your brand as something you measure on a schedule rather than assume.

What the alarm gets wrong

Somebody once hid an instruction on a webpage telling any AI that read it to print the word “cabbage” five million times.

That is roughly the state of the art in the wild. Everything above comes from laboratories, and in March 2026 Unit 42 at Palo Alto Networks went and checked the street instead, analysing real prompt injection found in live web telemetry. Their picture is much duller than the benchmarks, and usefully so.

• The most common attacker intent by far was irrelevant output, at 28.6%. Jokes, anti-scraping notices, cabbage.
• 85.2% of the jailbreak attempts were plain social engineering. No clever encoding, no adversarial optimisation.
• 75.8% of affected pages carried a single injected prompt.
• They logged what they believe is the first real case of an AI ad review system being bypassed this way, in December 2025, and noted they have not confirmed any successful attack against a deployed ad-checking agent.

Their own conclusion is worth repeating: there is a gap between how severe these attacks are in demonstrations and how limited and opportunistic they look in practice so far.

Both things are true at once. The vulnerability is deep, well documented, and resistant to the obvious fixes. Exploitation is still mostly amateur hour. Anyone selling you an urgent solution should be asked which of those two facts they are pricing.

The rules were written before the readers changed

Review manipulation was already illegal before agents showed up, and the law happens to have anticipated part of this. The FTC’s 16 CFR Part 465, approved on a 5 to 0 vote and effective 21 October 2024, bans buying, selling and disseminating fake reviews, and the Commission was explicit in announcing the rule that it wanted to deter AI-generated ones. Because it is a trade regulation rule rather than case-by-case enforcement, the agency can now seek civil penalties.

Scale is harder to pin down than anyone admits. The most-cited estimate is that around 4% of online reviews are fake, influencing $152 billion in global spending. That figure comes from a 2021 World Economic Forum piece built on self-reported data from the platforms themselves, it is five years old, and the much larger numbers circulating online trace back to sources that do not survive a click. Treat 4% as a floor of unknown accuracy rather than a fact.

What has changed is who gets fooled. A fake review used to need to persuade a person. Now it only needs to be parsed.

What nobody has measured yet

Put the two studies side by side and there is a hole between them.

ACES gives clean causal estimates, and its agents never read a review. StakeBench puts review text in front of agents, and every review in it is hostile. So the ordinary case, an agent reading fifty genuine reviews of a genuine product with nobody trying anything on, has not been studied at scale by anyone.

Which means the most common advice in this category, that you should write detailed and specific reviews because agents reward depth, currently rests on vendor blog posts rather than published research. It might be right. Nobody has shown it.

Where to start

Take one product. Run the five checks and write down what you find, particularly step three, where reading your own reviews as if they were commands tends to be more revealing than people expect. Then put a note in the calendar to do it again after the next major model release, because the December 2025 numbers say that is when your position moves.

For the wider context on how machine readers are reshaping discovery, our piece on advertising to AI agents covers the same shift from the media-buying side. On the retail side, agentic checkout is already live, even though almost nobody is using it yet.

Frequently asked questions